Vulnerability disclosure
How to report a security vulnerability in RunsOn, what to include, the rules for testing, and the safe harbor for good-faith research.
Report suspected vulnerabilities to security@runs-on.com. RunsOn aims to acknowledge a report within five (5) business days.
What to include#
- affected RunsOn version;
- deployment model (Flex or Fleet) and relevant configuration;
- reproduction steps;
- impact assessment;
- logs or screenshots with secrets removed;
- preferred contact details.
Rules for testing#
Do not access, modify, delete, or exfiltrate data that does not belong to you. Do not perform denial-of-service testing, social engineering, physical attacks, or attacks against third-party services.
Safe harbor#
RunsOn will not pursue legal action against security researchers who make a good-faith vulnerability report and comply with the rules above. This safe harbor does not apply to unlawful activity, extortion, privacy violations, data exfiltration, persistence, denial-of-service activity, social engineering, physical attacks, or attacks against third-party services.
Related#
- Security model: what runs where, and what leaves your AWS account.
- Privacy Notice